feat(partner): require WeChat OAuth before store photo upload

Co-authored-by: Cursor <cursoragent@cursor.com>

server/dukang-api/src/modules/iam/auth.controller.ts

@@ -114,7 +114,17 @@ export class PartnerAuthController {
   }
 
   @Post('login/wechat')
-  wechatLogin(@Body() dto: LoginWechatDto) {
+  @UseGuards(OptionalJwtAuthGuard)
+  wechatLogin(@Req() req: Request, @Body() dto: LoginWechatDto) {
+    const user = (req as Request & { user?: AuthUser }).user;
+    if (user?.actorType === 'PARTNER') {
+      return this.authService.bindPartnerWechat(
+        user.actorId,
+        dto.code,
+        ClientApp.PARTNER_H5,
+        dto.platform ?? 'h5',
+      );
+    }
     return this.authService.loginPartnerWechat(dto.code, ClientApp.PARTNER_H5, dto.platform ?? 'h5');
   }
 }

server/dukang-api/src/modules/iam/auth.service.ts

@@ -498,6 +498,51 @@ export class AuthService {
     });
   }
 
+  async bindPartnerWechat(
+    partnerAccountId: bigint,
+    code: string,
+    clientApp: ClientApp,
+    platform: 'h5' | 'mini' = 'h5',
+  ) {
+    this.assertWechatEnabled();
+    const session =
+      platform === 'mini'
+        ? await this.wechatProvider.code2Session(code)
+        : await this.wechatProvider.oauth2AccessToken(code);
+
+    const account = await this.prisma.partnerAccount.findUnique({
+      where: { id: partnerAccountId },
+      include: { partner: true },
+    });
+    if (!account) throw new BadRequestException('合伙人账号不存在');
+
+    const conflict = await this.prisma.partnerAccount.findFirst({
+      where: { wxOpenId: session.openId, id: { not: partnerAccountId } },
+    });
+    if (conflict) {
+      throw new BadRequestException('该微信已绑定其他合伙人账号');
+    }
+
+    const updated = await this.prisma.partnerAccount.update({
+      where: { id: partnerAccountId },
+      data: {
+        wxOpenId: session.openId,
+        wxUnionId: session.unionId ?? account.wxUnionId,
+        lastLoginAt: new Date(),
+      },
+      include: { partner: true },
+    });
+
+    return this.issueToken('PARTNER', updated.id, clientApp, false, undefined, undefined, {
+      id: updated.id.toString(),
+      partnerId: updated.partnerId.toString(),
+      name: updated.name,
+      phone: updated.phone,
+      isPrimary: updated.isPrimary === 1,
+      companyName: updated.partner.companyName,
+    });
+  }
+
   async loginPartnerWechat(code: string, clientApp: ClientApp, platform: 'h5' | 'mini' = 'h5') {
     this.assertWechatEnabled();
     const session =

server/dukang-api/src/modules/settlement/settlement.controller.ts

@@ -32,6 +32,7 @@ export class PartnerMeController {
       phone: account.phone,
       isPrimary: account.isPrimary === 1,
       companyName: account.partner.companyName,
+      hasWechat: !!account.wxOpenId,
     };
   }
 }